Virus - Please solve me how to deal with this virus

[allen337]

according to your post it will be deleted on reboot, did you select reboot from mailwarebytes and let it remove it? Run mailwarebytes again and see if it still has a virus

when mailwarebytes gets finished it lets you select all and remove then it asks to reboot to remove them, its asking

 

[oily_17]

When you reboot after running MalwareBytes, you could download RootRepeal

# Open RootRepeal on your desktop.
# Click the Report tab.
# Click the Scan button.
# Check all seven boxes that appear in the pop up window.
# Push Ok
# Check the box for your main system drive (Usually C:\), and press Ok.
# Allow RootRepeal to run a scan of your system.
# Once the scan completes, push the Save Report button. Save the log to your desktop, and post it up.

 

[freebird_9924]

When you reboot after running MalwareBytes, you could download RootRepeal

# Open RootRepeal on your desktop.
# Click the Report tab.
# Click the Scan button.
# Check all seven boxes that appear in the pop up window.
# Push Ok
# Check the box for your main system drive (Usually C:\), and press Ok.
# Allow RootRepeal to run a scan of your system.
# Once the scan completes, push the Save Report button. Save the log to your desktop, and post it up.

I've o=posted log of many programs.. They are detecting virus..

i'm tired now to use one more program which will just detect that only.

you can check this thread for full log.
http://forums.techpowerup.com/showpost.php?p=1616334&postcount=36

according to your post it will be deleted on reboot, did you select reboot from mailwarebytes and let it remove it? Run mailwarebytes again and see if it still has a virus

when mailwarebytes gets finished it lets you select all and remove then it asks to reboot to remove them, its asking

I did it twice again and it's not deleting it.

 

[oily_17]

I've o=posted log of many programs.. They are detecting virus..

i'm tired now to use one more program which will just detect that only.

The reason I said to try RootRepeal is that it can show hidden drivers/services etc.

You can then use RootRepeal to 'wipe' the file and then hopefully MalwareBytes will be able to clean the rest of the system.

The reason that MalwareBytes is not working at the moment is because these rootkits are designed to stop antivirus/malware programs from running correctly.
If you would like to read more on this then take a look at this -

http://www.malwarebytes.org/forums/index.php?showtopic=12709

 

[Boyfriend]

Seems complicated.
anyways, i'll try it.
Thanks.

Well, kaspersky bootcd was working and it was detecting removable drives but not my internal hdd, may be bcz it is ntfs system.

anyways, thanks.

Kaspersky BootCD works well with FAT, FAT32, and NTFS (may be also with Linux file system ext3,4 etc. but I haven't tested). Try it again and I hope it will solve your problem. At least post GSI log. Even the malware (actually a rootkit) is being blocked by bitdefender, you should remove it as soon as possible, as it might have some backdoor which might expose your confidential information/data to outside world. It is already doing its job by hooking important system files and functions. You can't block all those hooks without proper removal.
Does the rootkit has infected master boot record also??

 

[freebird_9924]

The reason I said to try RootRepeal is that it can show hidden drivers/services etc.

You can then use RootRepeal to 'wipe' the file and then hopefully MalwareBytes will be able to clean the rest of the system.

The reason that MalwareBytes is not working at the moment is because these rootkits are designed to stop antivirus/malware programs from running correctly.
If you would like to read more on this then take a look at this -

http://www.malwarebytes.org/forums/index.php?showtopic=12709

Thanks.
Tried to run rootrepeal but after i open it, it's showing following error.

Log:

00:32:58: FOPS - DeviceIoControl Error! Error Code = 0xc0000024 Extended Info (0x000000f8)
00:32:58: DeviceIoControl Error! Error Code = 0x1e7
00:32:58: FOPS - DeviceIoControl Error! Error Code = 0xc0000024 Extended Info (0x000000f8)

 

[freebird_9924]

Kaspersky BootCD works well with FAT, FAT32, and NTFS (may be also with Linux file system ext3,4 etc. but I haven't tested). Try it again and I hope it will solve your problem. At least post GSI log. Even the malware (actually a rootkit) is being blocked by bitdefender, you should remove it as soon as possible, as it might have some backdoor which might expose your confidential information/data to outside world. It is already doing its job by hooking important system files and functions. You can't block all those hooks without proper removal.
Does the rootkit has infected master boot record also??

Thanks.

But i tried kaspersky , bitdefender and avast all 3 boot cd but none of them were able to detect my local hdd so wasnt able to scan.

i think only possible way now i have is some app doing bootscan and avast has it , but as i've bitdefender installed i cant install avast together isnt it? and if i'll uninstall bitdefender and install avast/kaspersky, i fear if in between rootkit will damage my data.

how to post GSI log?wht is it?

Thanks.

 

[oily_17]

Not sure what the problem is there !!

The only other thing I can think of is running ComboFix.

**NOTE: ComboFix is a tool used by Malware Experts to help remove infections and I dont have a lot of experience with using it**

If you like I can give you some instructions on running it.

EDIT: You can get info on downloading/running ComboFix here

 

[Boyfriend]

Thanks.
But i tried kaspersky ........
how to post GSI log?wht is it?
Thanks.

Follow the instructions given here. At least provide it. Kaspersky has built in AVZ script, which can be executed to remove severe infections. You don't need to register to post GSI log. I am waiting for the log...

 

[freebird_9924]

Follow the instructions given here. At least provide it. Kaspersky has built in AVZ script, which can be executed to remove severe infections. You don't need to register to post GSI log. I am waiting for the log...

http://www.getsysteminfo.com/read.php?file=1b90ebe9dff691da58fea5c760d2dfdd

 

[temp02]

Well I could tell you what to do, but that could take a long time, so I used google and got this *very* helpfull topic, read every post and comply with their instructions.

EDIT: basically all that you are supposed to do is run ComboFix (the post just "enlightens" you on how to do so). Oh and afterwards post the log here so we can check if it's "clean".

 

[Boyfriend]

I have reviewed your GSI log. As no Kaspersky product was installed, no infection report is there. You are using BitDefender 12, Windows Defender, MBAM at the same time. Disable Defender from control panel.
Here are ways to resolve the issue(s):
1. I still highly insist to install Kaspersky (don't forget to remove BitDefender and MBAM completely). Update it and let it do it's job. Download Kaspersky AV 2010 (9.0.0.736). It will recommend you to run a special scan to automatically remove detected malwares. Just allow it and see the magic.
2. Give a try to Panda AntiRootkit. It is automated and has proven working against numerous rootkit, hard to remove from working system. It has helped to remove two rootkits from my client's computer. They are also offering free support. Just download it and disconnect from internet --> Disable system restore to prevent reinfection from recovery point --> Restart system --> Disable BitDefender and MBAM (temporarily for better results, else conflict might appear) --> run a system scan --> let it do it's job and restart. Review the report. Don't forget to enable system restore and AV protection after cleanup.
3. Give a try to McAfee Rootkit Detective, AVG AntiRootkit, and Sophos Anti-Rootkit. These are also good and provide free support for rootkit removal. Don't forget to follow above steps (disable system restore.........).
4. If all fails, I will only recommended a boot from DVD/Recovery media --> Format C: --> Fresh install --> Don't open any drive (Whether HDD/CD/DVD/Flash etc.) until you have up to date AV to prevent reinfection from unknown infection vector --> Scan both HDD and other storage media.

 

[freebird_9924]

windows defender is already disabled.

1. I still highly insist to install Kaspersky (don't forget to remove BitDefender and MBAM completely). Update it and let it do it's job. Download Kaspersky AV 2010 (9.0.0.736). It will recommend you to run a special scan to automatically remove detected malwares. Just allow it and see the magic.

I would like to buy i fear after i'll uninstall and if rootkit will dot allow me to install kaspersky or other antivirus then?

2. Give a try to Panda AntiRootkit. It is automated and has proven working against numerous rootkit, hard to remove from working system. It has helped to remove two rootkits from my client's computer. They are also offering free support. Just download it and disconnect from internet --> Disable system restore to prevent reinfection from recovery point --> Restart system --> Disable BitDefender and MBAM (temporarily for better results, else conflict might appear) --> run a system scan --> let it do it's job and restart. Review the report. Don't forget to enable system restore and AV protection after cleanup.

This is last one i'm going to try now.
tired with fight against rootkit trojen now.

3. Give a try to McAfee Rootkit Detective, AVG AntiRootkit, and Sophos Anti-Rootkit. These are also good and provide free support for rootkit removal. Don't forget to follow above steps (disable system restore.........).

4. If all fails, I will only recommended a boot from DVD/Recovery media --> Format C: --> Fresh install --> Don't open any drive (Whether HDD/CD/DVD/Flash etc.) until you have up to date AV to prevent reinfection from unknown infection vector --> Scan both HDD and other storage media.

Now if i wont be able to deal with it, i'll fresh install windows again.

Can u check my specs and if windows 7 is ok for me?

Rightnow i'm on Windows vista home premium. Windows 7 will make more slower than vista or same or less?

 

[freebird_9924]

Well I could tell you what to do, but that could take a long time, so I used google and got this *very* helpfull topic, read every post and comply with their instructions.

EDIT: basically all that you are supposed to do is run ComboFix (the post just "enlightens" you on how to do so). Oh and afterwards post the log here so we can check if it's "clean".

it has done nothing useful.

just told following 3 infected files.

c:/windows/system32/drives/kbiwkmbjoprotq.sys
c:/windows/system32/drives/kbiwkmoikuyrfl.sys
c:/windows/system32/drives/kbiwkmotaonqts.sys

 

[TheMailMan78]

windows defender is already disabled.



I would like to buy i fear after i'll uninstall and if rootkit will dot allow me to install kaspersky or other antivirus then?



This is last one i'm going to try now.
tired with fight against rootkit trojen now.







Now if i wont be able to deal with it, i'll fresh install windows again.

Can u check my specs and if windows 7 is ok for me?

Rightnow i'm on Windows vista home premium. Windows 7 will make more slower than vista or same or less?

Windows 7 is the same in most areas. However it is snappier in day to day usage.

Without reading all the pages have you run "hijack" yet?

 

[freebird_9924]

Windows 7 is the same in most areas. However it is snappier in day to day usage.

Without reading all the pages have you run "hijack" yet?

Thanks. so do u recommand me windows 7 over vista and if will not affect speed or performance?

how to tun hijack?

 

[TheMailMan78]

Thanks. so do u recommand me windows 7 over vista and if will not affect speed or performance?

how to tun hijack?

Honestly there is no need for windows 7 if you are already running vista. I enjoy it because its "new" and I like the latest. However in real world use I doubt you'll see any benefit.

Try this man....

http://free.antivirus.com/hijackthis/

 

[freebird_9924]

Honestly there is no need for windows 7 if you are already running vista. I enjoy it because its "new" and I like the latest. However in real world use I doubt you'll see any benefit.

Try this man....

http://free.antivirus.com/hijackthis/

I too like new and latest.

And if i've to format, then y not try latest?

that's y but only thing i concern is speed and performance.
will it improve or it'll slow down further?

attached hijackthis log.

 

[Boyfriend]

HijackThis log tells nothing about the rootkit. It is telling that you have even tried combofix with no success. Some missed files entries are also there in your registry.
Have you tried Panda Anti-Rootkit and other Anti-Rootkits? Probably Panda Anti-Rootkit or McAfee Anti-Rootkit will solve your problem.

Can u check my specs and if windows 7 is ok for me?

Rightnow i'm on Windows vista home premium. Windows 7 will make more slower than vista or same or less?

1. As you are already running Windows Vista, there should be no problem with spec. During installation, Windows 7 will install most of required drivers without any problem. Still it is best to run this tool from Microsoft. Attach all the peripherals you use, run the Windows 7 upgrade advisor, and see if there will be any compatibility/conflicting issue. It will point you out clearly everything, and if needed will suggest u as well.

2. Windows 7 is much lighter and fast than Windows Vista SP2. It also offers numerous advantages over Vista. I am running Windows 7 x64 (Check my spec). I am so pleased and addicted to 7 that sometimes I forgot that I am on XP (at client computer) and trying to get jumplist, Flip3D, and Aero snap . No problem for me at all . All major vendors are already supporting Windows 7 and 64-bit softwares are also there . Give it a try and you will never wish to run Vista again.

 

[freebird_9924]

HijackThis log tells nothing about the rootkit. It is telling that you have even tried combofix with no success. Some missed files entries are also there in your registry.
Have you tried Panda Anti-Rootkit and other Anti-Rootkits? Probably Panda Anti-Rootkit or McAfee Anti-Rootkit will solve your problem.



1. As you are already running Windows Vista, there should be no problem with spec. During installation, Windows 7 will install most of required drivers without any problem. Still it is best to run this tool from Microsoft. Attach all the peripherals you use, run the Windows 7 upgrade advisor, and see if there will be any compatibility/conflicting issue. It will point you out clearly everything, and if needed will suggest u as well.

2. Windows 7 is much lighter and fast than Windows Vista SP2. It also offers numerous advantages over Vista. I am running Windows 7 x64 (Check my spec). I am so pleased and addicted to 7 that sometimes I forgot that I am on XP (at client computer) and trying to get jumplist, Flip3D, and Aero snap . No problem for me at all . All major vendors are already supporting Windows 7 and 64-bit softwares are also there . Give it a try and you will never wish to run Vista again.

Thanks.

I tried to run panda antiroot kit but it shows error "OS not supported"

Will try any other 2 antiroot later and reply here.

 

[freebird_9924]

GoodNews friends.

Finally i've won against this bad trojen rootkit.

I dont know how but yesterday i've runned tuneup utilities click maintainance and malware bytes quick scan at a time and malware bytes has detected some trojen files and quarantined them and there were no root files which required to delete on boot and after i restart my laptop and rescan with malwarebyte, there are no trojen now.

So i've beaten bad trojen rootkit finally. Thanks to all here for advice.

 

[mdsx1950]

If your using a free Antivirus. Use Avira AntiVir (One of the best ive used so far )

If your using a paid one go for ESET NOD or Kaspersky.

You wont get a virus again ^^

 

[Espera]

Glad you fixed the problem.

I remember getting two infected HD's off an XP machine to save the images and documents. Before I connected the HD's via a USB connection I had to disable Auto Run on my Vista Machine and I also setup a parental controlled account to do the scanning, only letting AVG, and Malwarebytes run. Winrar constantly tried to run as well as other unnamed programs but they were blocked by the parental control. It may not have been the full proof method of scanning but it worked. I scanned for 3days straight and found new Trojans and back doors each day, until on the 4th day the list was blank.